domains / families / security / hunting-for-defense-evasion-via-timestomping

hunting-for-defense-evasion-via-timestomping

separate

'Detect NTFS timestamp manipulation (MITRE T1070.006) by comparing $STANDARD_INFORMATION

When to use

• Investigating suspected anti-forensic activity where an adversary may have altered file timestamps to blend malware into legitimate directories
• Threat hunting for defense evasion (MITRE ATT&CK T1070.006) across compromised Windows systems
• Validating timeline integrity during forensic examinations of disk images or live acquisitions
• Triaging suspicious files that appear to have creation dates older than the OS installation or inconsistent with known deployment timelines
• Detecting tools like Timestomp (Metasploit), NTimeStomp, SetMACE, or PowerShell Set-ItemProperty used to alter timestamps
• Building automated detection pipelines that flag temporal anomalies in MFT data for SOC analysts

When not to use

• Sole detection method for advanced adversaries who manipulate both SI and FN timestamps

Skill page

Source